CVE-2026-64622 Details
Description
Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply the configured authorization check (checkAuth/secret) to the ApprovalInbox GET read routes, so even when an operator configures a secret, unauthenticated actors can access sensitive approval request details. The GET /approvals/?status=all, GET /approvals/:id, GET /approvals/stats, and GET /approvals/sse routes disclose full ApprovalEntry content including action/target shell-command strings, file paths, justifications, and risk levels. All responses also carry a hardcoded Access-Control-Allow-Origin: * header, enabling cross-origin disclosure from any website the operator visits. This is an incomplete fix for GHSA-mxjx-28vx-xjjj.
A vulnerability exists in Network-AI versions 5.12.2 through 5.13.3, where the ApprovalInbox GET read routes do not properly enforce authorization checks. This oversight allows unauthenticated users to access sensitive approval request information, even if a secret has been configured by the operator. The vulnerable GET routes include /approvals/?status=all, /approvals/:id, /approvals/stats, and /approvals/sse. These routes leak full ApprovalEntry details, such as action and target command strings, file paths, justifications, and risk levels. Additionally, all responses include a hardcoded Access-Control-Allow-Origin: * header, which permits cross-origin information sharing from any website the operator visits. This vulnerability represents an incomplete fix for a previously identified issue.
Users can update to Network-AI version 5.13.4, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 20, 2026CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-m4jg-6w3q-gm86 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-m4jg-6w3q-gm86 | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/network-ai-through-missing-authorization-via-approvalinbox | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Network-AI | >= 5.12.2, <= 5.13.3 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Modified | [email protected] |
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 20, 2026 | New CVE Received | [email protected] |